A Report on Codes of Conduct

Compliance software vendor LRN Corp. released its latest study of corporate codes of conduct last week. Given that the code of conduct is a sacred text for compliance programs everywhere, let’s look at the findings to see what’s common practice for codes these days and how much those practices do or don’t matter in today’s world.

The report is available on LRN‘s website, and we should always beware that LRN does sell software and consulting services to compliance officers, so it has a commercial interest in talking about this stuff. That said, the study is still worth your time. LRN reviewed 194 codes from large corporations around the world, and surveyed 2,000 employees across 15 countries about how their codes are used or perceived in the workplace. So there’s plenty of food for thought here. 

Among the major findings…

Companies are updating their codes at a fairly steady pace. LRN found that 73 percent of codes it studied had been updated within the last three years; and 60 percent of that group had made substantive updates rather than just cosmetic changes. Equally interesting: 45 percent of companies update their code annually, up from only 11 percent in 2014.

Companies are mentioning artificial intelligence in their codes much more often. In 2023, only 5 percent of companies LRN studied mentioned AI in their Code of Conduct; today that figure is 15 percent. This still means that 85 percent of companies don’t mention AI in their codes — although as we’ll discuss presently, I’m not convinced that’s a big deal. 

More codes are becoming more user-friendly, such as by including links to specific company policies, ethical decision-making models, or lists of other resources employees might find useful. One aid that’s not becoming more common: including real-life scenarios of ethical challenges that employees might encounter; only 30 percent of companies did that in 2025, unchanged from 2023.

Middle managers talk about the code less often than senior managers. Only 53 percent of rank-and-file employees said they had heard their managers talking about the Code of Conduct, compared to 85 percent who said the same about their company’s senior executives — but again, I’m not sure that gap is something to worry about.  

Those were the big findings. Now let’s take a deeper dive into what they mean. 

AI, Other Risks, and What the Code Covers

Let’s start with the question of whether your Code of Conduct should discuss artificial intelligence. My quibble with this idea is that while AI is definitely a risk that needs your company’s attention, it isn’t “conduct” unto itself — and we are talking about codes of conduct, after all. 

That is, a code of conduct would never specifically warn employees about the perils of spreadsheets or databases or cloud computing, because those things are simply technology tools that employees do their daily jobs. AI might be a new technology tool, but it’s still just a tool. So why should it deserve special mention in the code of conduct? 

I know some people will say, “Hold on; you just said AI is a risk, and my code mentions lots of risks. It mentions anti-corruption risk, antitrust risk, harassment risk. Why doesn’t AI fall into that category?”

Because those risks — anticorruption, antitrust, harassment, and even more such as conflicts of interest or retaliation against whistleblowers — all involve how an employee behaves on the job. Those risks are, quite literally, about how an employee conducts himself or herself on the job; and like we said before, this is the code of conduct we’re talking about.

So what about risks such as data privacy, cybersecurity, and reckless use of AI? You could sweep such issues into a clause addressing employees’ responsible use of technology along the lines of “all employees are expected to use technology and IT systems with due care and in accordance with our ethical values.” That keeps the emphasis on employee conduct (where it belongs), while you still name-check specific examples of technology tools that might cause trouble if an employee is reckless. 

My take is that a good code focuses on how employees should behave more than the specific ways they might misbehave and that should be avoided. (If you disagree, let me know at [email protected] and we can run a follow-up post.)

The Middle Manager Gap

Next is this matter of middle managers talking about the code of conduct less often than senior executives. I’m not worried about that gap.

Why not? Because it’s the senior executive’s job to define and guide the corporate culture. The code of conduct is an important framing mechanism to do that job, so of course the senior executive should mention the code regularly when talking to the workforce. He or she should talk about how the code helps to guide business decisions, assess organizational and individual performance, and so forth.

Middle managers have a different job. They focus more on operations and tactics. So I’m OK with middle managers mentioning the code less often. 

I’d be alarmed if middle managers never mention the code or ethical culture, but that’s not what LRN’s study found. Many middle managers do mention the code, and that’s welcome news — but talking specifically about the code of conduct is less important for middle managers than it is for senior executives.

Middle managers should talk with their teams about how to do daily work tasks in an ethical manner. For example, they could casually say, “We don’t pay bribes because that’s not how we operate here,” or “No sexually loaded jokes, that’s gross and makes people feel awkward.” Indeed, the informality of that approach might even be more effective than citing chapter and verse of the company’s code. 

The plain truth is that while middle managers and senior executives both rely on the code of conduct, they rely on it in different ways. The important point is that both groups know how to communicate about ethics and conduct in a practical, effective way given their specific role. 

More User-Friendly Codes

One point I did like to hear was that codes are becoming more user-friendly. This is wonderful because for far too long, the code of conduct was a stuffy, static, formal document that everybody read at their employee onboarding and then forgot all about. That was a tremendous waste of ethical opportunity, but you can’t blame people for not paying much attention to a glorified piece of paper.

Now the code of conduct can be more like a front door that opens into a much richer body of assistance for employees to understand how they should do their jobs. That is, the code doesn’t need to be a single document that’s 40 pages long. It can be a two-page summary that neatly emphasizes your core ethical priorities, and then connects to 38 other pages that explain various policies or procedures. The technology is there to do that.

Or, put another way, the code can give companies a rough sense of how they should behave in all situations; and then guide them to further instructions (in a policy manual, for example) on exactly how they should behave in specific situations. 

I even wonder whether we’ll eventually reach a point where a web-enabled code of conduct, an interactive policy manual, and customized, on-the-spot, AI-driven training will achieve some sort of compliance program singularity, where multiple elements of the traditional program all collapse into a single entity. 

But that’s speculation for another post.